Keep PWA builds coherent by bypassing the HTTP cache

The service worker populated a new build's cache with plain addAll(),
which the browser may satisfy from its HTTP cache — and static assets
were served without Cache-Control, so Safari's heuristic caching could
hold app.js for days. Together that could install a mixed build: a
fresh index.html whose buttons reference listeners a stale app.js never
registers.

Install now fetches assets with cache: "reload", and the server marks
all static assets no-cache (revalidation is a cheap 304; fast/offline
loads are the SW cache's job anyway).

server/main.go

@@ -806,12 +806,13 @@ func main() {
 				serveSW(w, *staticDir, swVer)
 				return
 			}
-			// PWA: manifest.json must revalidate so updates propagate.
-			if r.URL.Path == "/manifest.json" {
-				w.Header().Set("Cache-Control", "no-cache")
-			}
 			// SPA fallback: unknown paths -> index.html (so deep links work).
 			if !strings.HasPrefix(r.URL.Path, "/api/") {
+				// All static assets revalidate on every request (cheap 304s via
+				// Last-Modified). Offline/fast loads are the service worker
+				// cache's job; leaving these to the browser's heuristic HTTP
+				// caching let a stale app.js pair with a fresh index.html.
+				w.Header().Set("Cache-Control", "no-cache")
 				candidate := filepath.Join(*staticDir, filepath.FromSlash(r.URL.Path))
 				if r.URL.Path != "/" {
 					if info, err := os.Stat(candidate); err != nil || info.IsDir() {